- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 46, Issue 102 Why is groupname field blank in radacct
by ngwarai zed 26 Feb '09

26 Feb '09

Hallo all, First of all thanks Kalik for your responses. I checked the link you you sent but I couldn't get the info I am looking for. Let me expand further on the problem:- I have MySQL 5.0.67 and PostgreSQL 8.3.6 and freeRADIUS 2.17 installed on GNU/Linux Fedora 10 distribution. I have identical radius databases on both MySQL and PostgreSQL. When I use the PostgreSQL, the groupname field in the radacct table gets filled in but when I change the database to MySQL, the groupname filled is blank. I checked the queries in mysql/diaup.conf and postgresql/dialup.conf and found out that they are the same. Why is it working with PostgreSQL and not working with MySQL? The groupnames are defined in radusergroup table. May you help me on a step by step basis on how to solve this problem. THank you 2009/2/25 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 46, Issue 98 : Why is > groupnamefield blank in radacct (tnt(a)kalik.net) > 2. Re: Error: WARNING: Unresponsive child for request in module > sqlcomponent accounting (magicboiz) > 3. Rlm_sqlcounter log problem (Devrim Seral) > 4. Re: Error: WARNING: Unresponsive child for request in > modulesqlcomponent accounting (tnt(a)kalik.net) > 5. Re: Rlm_sqlcounter log problem (Juan Pablo Botero) > 6. Re: Freeradius dies with Postgresql error (Alan DeKok) > 7. Re: FR 2.1.3 and ASSERT FAILED event.c (Alan DeKok) > 8. Re: Rlm_sqlcounter log problem (tnt(a)kalik.net) > 9. Re: Wired 802.1x auth - Getting the IP address of the authed > machine (Alexander Clouter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 25 Feb 2009 15:21:20 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Freeradius-Users Digest, Vol 46, Issue 98 : Why is > groupnamefield blank in radacct > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <gS8vCrCQ.1235571680.7009450.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I tried editing the dialup.conf and added groupname with a value of > >'%{SQL-Group}' but still it writes nothing for the groupname in the > radacct > >table. Can you help me as to how exactly I have to edit the dialup.conf ? > > > > That is fine, only the attribute is wrong. ASFAIK Class is the only > attribute that you can custom set during authentication that NAS will > have to send back in accounting packet. > > http://freeradius.org/rfc/rfc2865.html#Class > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 2 > Date: Wed, 25 Feb 2009 15:40:04 +0100 > From: magicboiz <magicboiz(a)gmail.com> > Subject: Re: Error: WARNING: Unresponsive child for request in module > sqlcomponent accounting > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <200902251540.04783.magicboiz(a)gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Thx Ivan, > > and do you know if the accouting registers is lost? or another child > retries > the insert into the database? > > thx > Regards > > > On Mi?rcoles 25 Febrero 2009 14:09:44 tnt(a)kalik.net wrote: > > >I facing this problem with my Freeradius 2.1.3, and I don't know how to > > > solve it :( > > > > > >My NAS is sending only accounting registers to my freeradius server. My > > >freeradius server, is configured to store these registers into a MySQL > > > server. I have configured "max_request_time = 120", in the case of > MySQL > > > slow performance, but the problem perssits. > > > > No, you don't have a problem with radius server but with sql one. > > Perhaps you should look into the server that does have a problem (sql) > > and not the one that doesn't (radius). There is nothing radius server > > can tell you about why are sql queries running slow. > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 3 > Date: Wed, 25 Feb 2009 16:51:46 +0200 > From: Devrim Seral <dseral(a)gmail.com> > Subject: Rlm_sqlcounter log problem > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <416697d80902250651s7ed9e1earb3cd4ca611c27748(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi all, > I have a little problem with freeradius. And i can't find any solution for > it.. > We have logged failed login attempt following statement: (Its taken > from Freeradius Wiki) > Post-Auth-Type REJECT { > # Login failed: log to SQL database. > sql > } > > However when we use rlm_sqlcounter this modle can't handled with above > statement. > > So how its possible to log users that Rejected by rlm_sqlcounter module? > Regards.. > devrim > > > ------------------------------ > > Message: 4 > Date: Wed, 25 Feb 2009 15:53:36 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Error: WARNING: Unresponsive child for request in > modulesqlcomponent accounting > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <WfvWLTm6.1235573616.3312510.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >and do you know if the accouting registers is lost? or another child > retries > >the insert into the database? > > > > They usually are - there are no handles to write to the database as the > whole server gets blocked. I haven't seen tha case where single handle > would dia and the rest of them would continue working. This is usually > terminal state of radius-sql server connection problem. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 5 > Date: Wed, 25 Feb 2009 09:54:35 -0500 > From: Juan Pablo Botero <juanpabloboterolopez(a)gmail.com> > Subject: Re: Rlm_sqlcounter log problem > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <aaa6fffc0902250654t7355ae6bt315ff0cd3f706324(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > In My case, that it's not necesary, you can comment out that lines; and > probe with 'freeradius -X' > > On Wed, Feb 25, 2009 at 9:51 AM, Devrim Seral <dseral(a)gmail.com> wrote: > > > Hi all, > > I have a little problem with freeradius. And i can't find any solution > for > > it.. > > We have logged failed login attempt following statement: (Its taken > > from Freeradius Wiki) > > Post-Auth-Type REJECT { > > # Login failed: log to SQL database. > > sql > > } > > > > However when we use rlm_sqlcounter this modle can't handled with above > > statement. > > > > So how its possible to log users that Rejected by rlm_sqlcounter module? > > Regards.. > > devrim > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > Juan Pablo Botero > Administrador de Sistemas inform?ticos > http://jpill.wordpress.com > eSSuX: http://slcolombia.org/eSSuX > Linux Registered user #435293 >

2 1

rlm_sql: Failed to create the pair: Failed to find IP address
by Ilya 26 Feb '09

26 Feb '09

Hello! Please help! I’ve got the following situation: In radcheck I’ve got: _______________________________________ |Username|ATTRIBUTE |OP|VALUE| |test |Cleartext-Password |:=|test | --------------------------------------- in radreply: ______________________________________________ |Username|ATTRIBUTE |OP|VALUE | |test |Framed-IP-Address|:=|081.018.118.238| ----------------------------------------------- And if I do radtest test test 127.0.0.1 0 testing123 Radius –X returns me reject: rad_recv: Access-Request packet from host 127.0.0.1 port 33157, id=32, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id rlm_sql: Failed to create the pair: Failed to find IP address for 081.018.118.238 rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail Invalid user: [test/test] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to 127.0.0.1 port 33157 Waking up in 4.9 seconds. Cleaning up request 0 ID 32 with timestamp +437 Ready to process requests. But if I, just for fun, replace this ip=081.018.118.238 for someone like 81.18.11.23: radcheck: _______________________________________ |Username|ATTRIBUTE |OP|VALUE| |test |Cleartext-Password |:=|test | --------------------------------------- in radreply: ______________________________________________ |Username|ATTRIBUTE |OP|VALUE | |test |Framed-IP-Address|:=|81.18.11.23 | ----------------------------------------------- Everything works fine and I get accept: rad_recv: Access-Request packet from host 127.0.0.1 port 33162, id=112, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM radusergroup WHERE UserName='test' rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using clear text password "test" [pap] User authenticated successfully ++[pap] returns ok Login OK: [test] (from client localhost port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 112 to 127.0.0.1 port 33162 Framed-IP-Address := 81.18.11.23 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 112 with timestamp +3 Ready to process requests. Please help me to resolve this problem. Thanks in advance. P.S. freeRADIUS v. 2.1.3 have a good day, ilya

2 1

Re: Secure FreeRADIUS & LDAP
by Peter Param 26 Feb '09

26 Feb '09

Thanks, i've got it working. Does it work by comparing the generated hash with the hash in the ldap backend? >>> tnt(a)kalik.net 23/02/2009 9:02 pm >>> >Does freeradius support SHA hashed passwords (on ldap backend)? > Yes. This is documented in doc/rlm_ldap included with the server. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

Wired 802.1x auth - Getting the IP address of the authed machine
by Paul Dealy 25 Feb '09

25 Feb '09

I have a wired 802.1x auth setup on cisco gear. I would like to record the IP address of machines that connect and are authorized. Is this possible? I currently see NAS-IP-Address and Client-IP-Address as the IP of the switch. The Calling-Station-Id is the correct mac address of the authorized machine. The machines that are connecting to be authed are allocated their address using dhcp. Cheers Paul

4 5

Rlm_sqlcounter log problem
by Devrim Seral 25 Feb '09

25 Feb '09

Hi all, I have a little problem with freeradius. And i can't find any solution for it.. We have logged failed login attempt following statement: (Its taken from Freeradius Wiki) Post-Auth-Type REJECT { # Login failed: log to SQL database. sql } However when we use rlm_sqlcounter this modle can't handled with above statement. So how its possible to log users that Rejected by rlm_sqlcounter module? Regards.. devrim

3 2

FR 2.1.3 and ASSERT FAILED event.c
by Chris Howley 25 Feb '09

25 Feb '09

Alan, Environment: SunOS 5.10 and FR 2.1.3 (stable) I encountered the following problem when the server received an Access-Challenge packet from a proxy server. Any help in fixing this problem would be appreciated. Thanks, Chris Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 194.82.174.185 port 1812, id=76, length=81 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 EAP-Message = 0x010300061920 Message-Authenticator = 0x193c8361dc660dd940460f693d6ebf9c State = 0xad8b0646ad881f6aaefeee6ec7165a25 Proxy-State = 0x313730 +- entering group post-proxy {...} [post_proxy_log] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/post-proxy-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-02-24/post-proxy-detail-16:00 [post_proxy_log] /usr/local/var/log/radius/radacct/%Y-%m-%d/post-proxy-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-02-24/post-proxy-detail-16:00 [post_proxy_log] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.101 - Tue Feb 24 16:02:50 2009 ++[post_proxy_log] returns ok [attr_filter.post-proxy] expand: %{Realm} -> jrs attr_filter: Matched entry DEFAULT at line 103 ++[attr_filter.post-proxy] returns updated [eap] No pre-existing handler found ++[eap] returns noop ASSERT FAILED event.c[3593]: fun != NULL Abort (core dumped)

2 1

Freeradius dies with Postgresql error
by Vegard Svanberg 25 Feb '09

25 Feb '09

I'm using Freeradius with a Postgresql backend. Every two or three days, Freeradius dies. These are the last lines from the log file: Tue Feb 24 21:15:31 2009 : Auth: Login OK: [XXXX] (from client YYYY port 3 cli ZZZZZZZZ) Tue Feb 24 21:16:34 2009 : Auth: Login OK: [XXXX] (from client YYYY port 3 cli ZZZZZZZZ) Tue Feb 24 21:16:48 2009 : Auth: Login OK: [XXXX] (from client YYYY port 4 cli ZZZZZZZZ) Tue Feb 24 21:18:32 2009 : Error: rlm_sql_postgresql: PostgreSQL Query failed Error: Tue Feb 24 21:18:32 2009 : Auth: Invalid user: [XXXX] (from client YYYY port 1509942 cli XX:XX:XX:XX:XX:XX) Then nothing (it's gone and has to be started up again). The problem is that this never happens if I run radiusd with -X, so I'm having trouble catching more info. Any clues? This is Freeradius 2.1.0 btw. I've just upgraded to 2.1.3 to see if the problem goes away. -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

2 1

Re: Freeradius-Users Digest, Vol 46, Issue 98 : Why is groupname field blank in radacct
by ngwarai zed 25 Feb '09

25 Feb '09

Thank Kalik I tried editing the dialup.conf and added groupname with a value of '%{SQL-Group}' but still it writes nothing for the groupname in the radacct table. Can you help me as to how exactly I have to edit the dialup.conf ? I am new to freeRADIUS so please bear with with. Thanks in anticipation. accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username,groupname, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}','%{SQL-Group}' , \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" 2009/2/25 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Freeradius-Users Digest, Vol 46, Issue 96 (Shimon Weinreich) > 2. Re: Why is groupname field blank in radacct (tnt(a)kalik.net) > 3. RE: SMF manifest to run freeradius in solaris 10 (Thomas Noppe) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 25 Feb 2009 11:53:56 +0200 > From: "Shimon Weinreich" <shimon(a)openu.ac.il> > Subject: RE: Freeradius-Users Digest, Vol 46, Issue 96 > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <A8DAF37AB05CA74C938F57DD19095766143614(a)AMNON.openu.local> > Content-Type: text/plain; charset="windows-1255" > > Tnx Ivan, > > I'll upgrade it. > > > ------- > ?????, > > ????? ???????? > ??????????? ?????? > > > -----Original Message----- > From: freeradius-users-bounces+shimon=openu.ac.il(a)lists.freeradius.org[mailto: > freeradius-users-bounces+shimon <freeradius-users-bounces%2Bshimon>= > openu.ac.il(a)lists.freeradius.org] On Behalf Of > freeradius-users-request(a)lists.freeradius.org > Sent: Wednesday, February 25, 2009 11:45 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 46, Issue 96 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. SMF manifest to run freeradius in solaris 10 (Thomas Noppe) > 2. Re: does peap/mschap-v2 must use with ldap? (Nicolas Goutte) > 3. RE: auth: Failed to validate the user - NEED SOME HELP ! > (tnt(a)kalik.net) > 4. RE: SMF manifest to run freeradius in solaris 10 (Mats Blomgren B) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 25 Feb 2009 10:09:45 +0100 > From: Thomas Noppe <thomas.noppe(a)uz.kuleuven.ac.be> > Subject: SMF manifest to run freeradius in solaris 10 > To: freeradius <freeradius-users(a)lists.freeradius.org> > Message-ID: > < > B44A93F24BD174408E495C668C3E3E763945333E06(a)EX2007-MBX-1.uz.kuleuven.ac.be> > > Content-Type: text/plain; charset="us-ascii" > > Has anyone got such a manifest for solaris 10? > > Kind regards > > Thomas > > > --------------------------------------------------------------------------------------------- > Thomas Noppe > Dienst Informatiesystemen - S&O > > thomas.noppe(a)uzleuven.be<mailto:thomas.noppe@uzleuven.be> > +32 16 34 79 87 > +32 16 34 78 01 > UZ Leuven | campus Gasthuisberg | Herestraat 49 | B - 3000 Leuven | > www.uzleuven.be<http://www.uzleuven.be> > >

2 1

Problem receiving requests
by Fernando 25 Feb '09

25 Feb '09

Hi all, I'm trying to comunicate Freeradius with an external entity (A). Freeradius sends some information to A, which is processed by A, and A requires contact Freeradius to obtain some attributes from a certain user. --------------------- ------------------------------------- | Freeradius | | External ENTITY A | ----------------------- -------------------------------------- Application specific request(TCP socket) ------------------------------------------------------------------------> processing time RADIUS (Access-Request) XX <----------------------------------------------------------------------- (A needs information) RADIUS (Access-Accept) -------------------------------------------------------------------------> getting attribute data Application specific response (TCP socket) <----------------------------------------------------------------------- XX ----> This request fails, not is processed by Freeradius. The message arrives to Freeradius' network interface but we can not see any debug message informing that the message is processed. Thank you very much, Fernando.

2 3

Re: Problem with configuring freeradius for WPA with LDAP having MD5 paswords
by sankalpk 25 Feb '09

25 Feb '09

Hi Ivan, Thanks a lot for the guidance. I rectified the problem. The debug mode shows that it is receiving the request from the WAN IP of the IP (192.168.104.xxx) , while the NAS-IP appeared to be the its LAN IP (192.168.1.xxx). As a result, Radius Server was trying to send the Access-Challenge to the LAN IP of the Access Point, which was not reachable, hence the problem. However, I stuck up at a later stage. The authentication is happening when the users are defined in the "users" file. Then I conencted the Radius Server to LDAP, which is working only if the "UserPassword" in LDAP is stored in plain-text. But my LDAP server contains all the paswords in md5 encypted format. I could not get a solution for authenticating users when their paswords are stored in MD5. I tried to generate MD5 password from the client machine (which is a windows XP) using a small script in C#, but the MD5 generated passwords from C# differ from those in LDAP ( quite strange !!!) When I supply the MD5 encrypted password (if passwords are encrypted using slappasswd in LDAP server) from the Windows XP client, it works fine. Can somebody help me in getting users authenticated with LDAP if the passwords are in MD5?? I went through a document in the Internet that says EAP does not support MD5 hashes, only EAP-GTC and PAP does. Can someone suggest a solution for getting users authenticated through AP whith their passwords stored in MD5?? Thanks and Regards, SaN >>I've been trying to autheticate a Wireless Acess Point through a Radius >>Server for last 1 month, but things doesn't seem to be working for me. >>The Radius Server is authenticating when I test it with the radtest >>command. It also worked for a Cisco 2950 switch. But no luck when I use >>the Access Point. I have tried 3 different accesspoints, including >>Linksys, D-Link and the Firepro, but none of them worked. >> >>I do not get any error when I check the radius in debug mode. It says >>"Sending Access-Challange to ....", but the client doesn't get >>authenticated. I seriously need help on this. >> >>1. Do I really need certificates for authentication? >> >> > >Yes. That conversation is EAP-TLS. *You* have selected that >authentication method when you were creating the connection. > > > >>Is there a way to >>achieve WPA with UserName and Password, without installing certificates? >> >> > >Yes. You can do PEAP with usernames and passwords. You might need to >install CA certificate if you are signing your own. > > > >>2. Should the AP send "User-Password" attribute to the Radius Server? >> >> > >No. > > > >>Or >>should the Radius Server send an Access-Challange to the AP, and AP does >>matching and all. >> >> > >AP does nothing. It jast passes the challenge to the users machine. > >Ivan Kalik >Kalik Informatika ISP > > > DISCLAIMER: This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may containconfidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email or any action taken in reliance on this e-mail is strictly prohibited and may be unlawful. The recipient acknowledges that Tulip Telecom Limited is unable to exercise control or ensure or guarantee the integrity of/overthe contents of the information contained in e-mail transmissions and further acknowledges that any views expressed in this message are those of the individual sender and no binding nature of the message shall be implied or assumed unless the sender does so expressly with due authority of Tulip Telecom Limited. Before opening any attachments please check them for viruses! and defects.

2 1